--- loncom/interface/domainprefs.pm	2022/01/19 17:07:56	1.160.6.118.2.3
+++ loncom/interface/domainprefs.pm	2022/08/30 20:03:05	1.160.6.118.2.9
@@ -1,7 +1,7 @@
 # The LearningOnline Network with CAPA
 # Handler to set domain-wide configuration settings
 #
-# $Id: domainprefs.pm,v 1.160.6.118.2.3 2022/01/19 17:07:56 raeburn Exp $
+# $Id: domainprefs.pm,v 1.160.6.118.2.9 2022/08/30 20:03:05 raeburn Exp $
 #
 # Copyright Michigan State University Board of Trustees
 #
@@ -218,10 +218,10 @@ sub handler {
                 'serverstatuses','requestcourses','helpsettings',
                 'coursedefaults','usersessions','loadbalancing',
                 'requestauthor','selfenrollment','inststatus',
-                'passwords','ltitools','wafproxy','ipaccess'],$dom);
+                'passwords','ltitools','ltisec','wafproxy','ipaccess'],$dom);
+    my %encconfig =
+        &Apache::lonnet::get_dom('encconfig',['ltitools','linkprot'],$dom,undef,1);
     if (ref($domconfig{'ltitools'}) eq 'HASH') {
-        my %encconfig =
-            &Apache::lonnet::get_dom('encconfig',['ltitools'],$dom,undef,1);
         if (ref($encconfig{'ltitools'}) eq 'HASH') {
             foreach my $id (keys(%{$domconfig{'ltitools'}})) {
                 if (ref($domconfig{'ltitools'}{$id}) eq 'HASH') {
@@ -232,12 +232,29 @@ sub handler {
             }
         }
     }
+    if (ref($domconfig{'ltisec'}) eq 'HASH') {
+        if (ref($domconfig{'ltisec'}{'linkprot'}) eq 'HASH') {
+            if (ref($encconfig{'linkprot'}) eq 'HASH') {
+                foreach my $id (keys(%{$domconfig{'ltisec'}{'linkprot'}})) {
+                    unless ($id =~ /^\d+$/) {
+                        delete($domconfig{'ltisec'}{'linkprot'}{$id});
+                    }
+                    if ((ref($domconfig{'ltisec'}{'linkprot'}{$id}) eq 'HASH') &&
+                        (ref($encconfig{'linkprot'}{$id}) eq 'HASH')) {
+                        foreach my $item ('key','secret') {
+                            $domconfig{'ltisec'}{'linkprot'}{$id}{$item} = $encconfig{'linkprot'}{$id}{$item};
+                        }
+                    }
+                }
+            }
+        }
+    }
     my @prefs_order = ('rolecolors','login','ipaccess','defaults','wafproxy','passwords',
                        'quotas','autoenroll','autoupdate','autocreate','directorysrch',
                        'contacts','usercreation','selfcreation','usermodification',
                        'scantron','requestcourses','requestauthor','coursecategories',
                        'serverstatuses','helpsettings','coursedefaults',
-                       'ltitools','selfenrollment','usersessions');
+                       'ltitools','selfenrollment','usersessions','lti');
     my %existing;
     if (ref($domconfig{'loadbalancing'}) eq 'HASH') {
         %existing = %{$domconfig{'loadbalancing'}};
@@ -281,7 +298,9 @@ sub handler {
                       header => [{col1 => 'Setting',
                                   col2 => 'Value'},
                                  {col1 => 'Institutional user types',
-                                  col2 => 'Name displayed'}],
+                                  col2 => 'Name displayed'},
+                                 {col1 => 'Mapping for missing usernames via standard log-in',
+                                  col2 => 'Rules in use'}],
                       print => \&print_defaults,
                       modify => \&modify_defaults,
                     },
@@ -527,6 +546,18 @@ sub handler {
                   print => \&print_ltitools,
                   modify => \&modify_ltitools,
                  },
+          'lti' =>
+                 {text => 'LTI Link Protection and LTI Consumers',
+                  help => 'Domain_Configuration_LTI_Provider',
+                  header => [{col1 => 'Encryption of shared secrets',
+                              col2 => 'Settings'},
+                             {col1 => 'Rules for shared secrets',
+                              col2 => 'Settings'},
+                             {col1 => 'Link Protectors',
+                              col2 => 'Settings'},],
+                  print => \&print_lti,
+                  modify => \&modify_lti,
+                 },
          'ipaccess' =>
                        {text => 'IP-based access control',
                         help => 'Domain_Configuration_IP_Access',
@@ -542,7 +573,7 @@ sub handler {
                             header => [{col1 => 'Log-in Service',
                                         col2 => 'Server Setting',},
                                        {col1 => 'Log-in Page Items',
-                                        col2 => ''},
+                                        col2 => 'Settings'},
                                        {col1 => 'Log-in Help',
                                         col2 => 'Value'},
                                        {col1 => 'Custom HTML in document head',
@@ -722,6 +753,8 @@ sub process_changes {
         $output = &modify_usersessions($dom,$lastactref,%domconfig);
     } elsif ($action eq 'loadbalancing') {
         $output = &modify_loadbalancing($dom,%domconfig);
+    } elsif ($action eq 'lti') {
+        $output = &modify_lti($r,$dom,$action,$lastactref,%domconfig);
     } elsif ($action eq 'passwords') {
         $output = &modify_passwords($r,$dom,$confname,$lastactref,%domconfig);
     } elsif ($action eq 'ltitools') {
@@ -743,7 +776,7 @@ sub print_config_box {
     } elsif ($action eq 'defaults') {
         $output = &defaults_javascript($settings); 
     } elsif ($action eq 'passwords') {
-        $output = &passwords_javascript();
+        $output = &passwords_javascript($action);
     } elsif ($action eq 'helpsettings') {
         my (%privs,%levelscurrent);
         my %full=();
@@ -762,6 +795,9 @@ sub print_config_box {
                                                       \@templateroles);
     } elsif ($action eq 'ltitools') {
         $output .= &ltitools_javascript($settings);
+    } elsif ($action eq 'lti') {
+        $output .= &passwords_javascript('secrets')."\n".
+                   &lti_javascript($dom,$settings);
     } elsif ($action eq 'wafproxy') {
         $output .= &wafproxy_javascript($dom);
     } elsif ($action eq 'autoupdate') {
@@ -812,7 +848,7 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') || ($action eq 'selfcreation') ||
             ($action eq 'usermodification') || ($action eq 'defaults') || ($action eq 'coursedefaults') ||
             ($action eq 'selfenrollment') || ($action eq 'usersessions') || ($action eq 'directorysrch') ||
-            ($action eq 'helpsettings') || ($action eq 'contacts') || ($action eq 'wafproxy')) {
+            ($action eq 'helpsettings') || ($action eq 'contacts') || ($action eq 'wafproxy') || ($action eq 'lti')) {
             $output .= $item->{'print'}->('top',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'passwords') {
             $output .= $item->{'print'}->('top',$dom,$confname,$settings,\$rowtotal);
@@ -847,7 +883,8 @@ sub print_config_box {
         if (($action eq 'autoupdate') || ($action eq 'usercreation') ||
             ($action eq 'selfcreation') || ($action eq 'selfenrollment') ||
             ($action eq 'usersessions') || ($action eq 'coursecategories') ||
-            ($action eq 'contacts') || ($action eq 'passwords')) {
+            ($action eq 'contacts') || ($action eq 'passwords') || 
+            ($action eq 'defaults') || ($action eq 'lti')) {
             if ($action eq 'coursecategories') {
                 $output .= &print_coursecategories('middle',$dom,$item,$settings,\$rowtotal);
                 $colspan = ' colspan="2"';
@@ -901,8 +938,8 @@ sub print_config_box {
             }
             $rowtotal ++;
         } elsif (($action eq 'usermodification') || ($action eq 'coursedefaults') ||
-                 ($action eq 'defaults') || ($action eq 'directorysrch') ||
-                 ($action eq 'helpsettings') || ($action eq 'wafproxy')) {
+                 ($action eq 'directorysrch') || ($action eq 'helpsettings') ||
+                 ($action eq 'wafproxy')) {
             $output .= $item->{'print'}->('bottom',$dom,$settings,\$rowtotal);
         } elsif ($action eq 'scantron') {
             $output .= $item->{'print'}->($r,'bottom',$dom,$confname,$settings,\$rowtotal);
@@ -1434,7 +1471,7 @@ sub print_login {
                       '<table><tr><th>'.$choices{'hostid'}.'</th>'.
                       '<th>'.$choices{'samllanding'}.'</th>'.
                       '<th>'.$choices{'samloptions'}.'</th></tr>'."\n";
-        my (%saml,%samltext,%samlimg,%samlalt,%samlurl,%samltitle,%samlnotsso,%styleon,%styleoff);
+        my (%saml,%samltext,%samlimg,%samlalt,%samlurl,%samltitle,%samlwindow,%samlnotsso,%styleon,%styleoff);
         foreach my $lonhost (keys(%domservers)) {
             $samlurl{$lonhost} = '/adm/sso';
             $styleon{$lonhost} = 'display:none';
@@ -1449,6 +1486,7 @@ sub print_login {
                     $samlalt{$lonhost} = $settings->{'saml'}{$lonhost}{'alt'};
                     $samlurl{$lonhost} = $settings->{'saml'}{$lonhost}{'url'};
                     $samltitle{$lonhost} = $settings->{'saml'}{$lonhost}{'title'};
+                    $samlwindow{$lonhost} = $settings->{'saml'}{$lonhost}{'window'};
                     $samlnotsso{$lonhost} = $settings->{'saml'}{$lonhost}{'notsso'};
                     $styleon{$lonhost} = '';
                     $styleoff{$lonhost} = 'display:none';
@@ -1466,6 +1504,12 @@ sub print_login {
                 $samlon = $samloff;
                 $samloff = ' ';
             }
+            my $samlwinon = '';
+            my $samlwinoff = ' checked="checked"';
+            if ($samlwindow{$lonhost}) {
+                $samlwinon = $samlwinoff;
+                $samlwinoff = '';
+            }
             my $css_class = $itemcount%2?' class="LC_odd_row"':'';
             $datatable .= '<tr'.$css_class.'><td><span class="LC_nobreak">'.$domservers{$lonhost}.'</span></td>'.
                           '<td><span class="LC_nobreak"><label><input type="radio" name="saml_'.$lonhost.'"'.$samloff.
@@ -1475,12 +1519,10 @@ sub print_login {
                           'onclick="toggleSamlOptions(this.form,'."'$lonhost'".');" value="1" />'.
                           &mt('Yes').'</label></span></td>'.
                           '<td id="samloptionson_'.$lonhost.'" style="'.$styleon{$lonhost}.'" width="100%">'.
-                          '<table><tr><th colspan="5" align="center">'.&mt('SSO').'</th><th align="center">'.
-                          '<span class="LC_nobreak">'.&mt('Non-SSO').'</span></th></tr>'.
+                          '<table width="100%"><tr><th colspan="3" align="center">'.&mt('SSO').'</th></tr>'.
                           '<tr><th>'.&mt('Text').'</th><th>'.&mt('Image').'</th>'.
-                          '<th>'.&mt('Alt Text').'</th><th>'.&mt('URL').'</th>'.
-                          '<th>'.&mt('Tool Tip').'</th><th>'.&mt('Text').'</th></tr>'.
-                          '<tr'.$css_class.'><td><input type="text" name="saml_text_'.$lonhost.'" size="8" value="'.
+                          '<th>'.&mt('Alt Text').'</th></tr>'.
+                          '<tr'.$css_class.'><td><input type="text" name="saml_text_'.$lonhost.'" size="20" value="'.
                           $samltext{$lonhost}.'" /></td><td>';
             if ($samlimg{$lonhost}) {
                 $datatable .= '<img src="'.$samlimg{$lonhost}.'" /><br />'.
@@ -1497,13 +1539,21 @@ sub print_login {
                 $datatable .= '<input type="file" name="saml_img_'.$lonhost.'" />';
             }
             $datatable .= '</td>'.
-                          '<td><input type="text" name="saml_alt_'.$lonhost.'" size="20" '.
-                          'value="'.$samlalt{$lonhost}.'" /></td>'.
-                          '<td><input type="text" name="saml_url_'.$lonhost.'" size="8" '.
+                          '<td><input type="text" name="saml_alt_'.$lonhost.'" size="25" '.
+                          'value="'.$samlalt{$lonhost}.'" /></td></tr></table><br />'.
+                          '<table width="100%"><tr><th colspan="3" align="center">'.&mt('SSO').'</th><th align="center">'.
+                          '<span class="LC_nobreak">'.&mt('Non-SSO').'</span></th></tr>'.
+                          '<tr><th>'.&mt('URL').'</th><th>'.&mt('Tool Tip').'</th>'.
+                          '<th>'.&mt('Pop-up if iframe').'</th><th>'.&mt('Text').'</th></tr>'.
+                          '<tr'.$css_class.'>'.
+                          '<td><input type="text" name="saml_url_'.$lonhost.'" size="30" '.
                           'value="'.$samlurl{$lonhost}.'" /></td>'.
-                          '<td><textarea name="saml_title_'.$lonhost.'" rows="3" cols="15">'.
+                          '<td><textarea name="saml_title_'.$lonhost.'" rows="3" cols="20">'.
                           $samltitle{$lonhost}.'</textarea></td>'.
-                          '<td><input type="text" name="saml_notsso_'.$lonhost.'" size="8" '.
+                          '<td><label><input type="radio" name="saml_window_'.$lonhost.'" value=""'.$samlwinoff.'>'.
+                          &mt('No').'</label>'.('&nbsp;'x2).'<label><input type="radio" '.
+                          'name="saml_window_'.$lonhost.'" value="1"'.$samlwinon.'>'.&mt('Yes').'</label></td>'.
+                          '<td><input type="text" name="saml_notsso_'.$lonhost.'" size="12" '.
                           'value="'.$samlnotsso{$lonhost}.'" /></td></tr>'.
                           '</table></td>'.
                           '<td id="samloptionsoff_'.$lonhost.'" style="'.$styleoff{$lonhost}.'" width="100%">&nbsp;</td></tr>';
@@ -3098,6 +3148,140 @@ function toggleWAF() {
 ENDSCRIPT
 }
 
+sub lti_javascript {
+    my ($dom,$settings) = @_;
+    my $togglejs = &lti_toggle_js($dom);
+    my $linkprot_js = &Apache::courseprefs::linkprot_javascript();
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+
+$linkprot_js
+
+// ]]>
+</script>
+
+$togglejs
+
+ENDSCRIPT
+}
+
+sub lti_toggle_js {
+    my ($dom) = @_;
+    my %servers = &Apache::lonnet::get_servers($dom,'library');
+    my $primary = &Apache::lonnet::domain($dom,'primary');
+    my $course_servers = "'".join("','",keys(%servers))."'";
+    return <<"ENDSCRIPT";
+<script type="text/javascript">
+// <![CDATA[
+function toggleLTIEncKey(form) {
+    var shownhosts = new Array();
+    var hiddenhosts = new Array();
+    var forcourse = new Array($course_servers);
+    var fromdomain = '$primary';
+    var crsradio = form.elements['ltisec_crslinkprot'];
+    if (crsradio.length) {
+        for (var i=0; i<crsradio.length; i++) {
+            if (crsradio[i].checked) {
+                if (crsradio[i].value == 1) {
+                    if (forcourse.length > 0) {
+                        for (var j=0; j<forcourse.length; j++) {
+                            if (!shownhosts.includes(forcourse[j])) {
+                                shownhosts.push(forcourse[j]);
+                            }
+                        }
+                    }
+                } else {
+                    if (forcourse.length > 0) {
+                        for (var j=0; j<forcourse.length; j++) {
+                            if (!hiddenhosts.includes(forcourse[j])) {
+                                hiddenhosts.push(forcourse[j]);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+    var domradio = form.elements['ltisec_domlinkprot'];
+    if (domradio.length) {
+        for (var i=0; i<domradio.length; i++) {
+            if (domradio[i].checked) {
+                if (domradio[i].value == 1) {
+                    if (!shownhosts.includes(fromdomain)) {
+                        shownhosts.push(fromdomain);
+                    }
+                } else {
+                    if (!hiddenhosts.includes(fromdomain)) {
+                        hiddenhosts.push(fromdomain);
+                    }
+                }
+            }
+        }
+    }
+    if (shownhosts.length > 0) {
+        for (var i=0; i<shownhosts.length; i++) {
+            if (document.getElementById('ltisec_info_'+shownhosts[i])) {
+                document.getElementById('ltisec_info_'+shownhosts[i]).style.display = 'block';
+            }
+        }
+        if (document.getElementById('ltisec_noprivkey')) {
+            document.getElementById('ltisec_noprivkey').style.display = 'none';
+        }
+    } else {
+        if (document.getElementById('ltisec_noprivkey')) {
+            document.getElementById('ltisec_noprivkey').style.display = 'inline-block';
+        }
+    }
+    if (hiddenhosts.length > 0) {
+        for (var i=0; i<hiddenhosts.length; i++) {
+            if (!shownhosts.includes(hiddenhosts[i])) {
+                if (document.getElementById('ltisec_info_'+hiddenhosts[i])) {
+                    document.getElementById('ltisec_info_'+hiddenhosts[i]).style.display = 'none';
+                }
+            }
+        }
+    }
+    return;
+}
+
+function togglePrivKey(form,hostid) {
+    var radioname = '';
+    var currdivid = '';
+    var newdivid = '';
+    if ((document.getElementById('ltisec_divcurrprivkey_'+hostid)) &&
+        (document.getElementById('ltisec_divchgprivkey_'+hostid))) {
+        currdivid = document.getElementById('ltisec_divcurrprivkey_'+hostid);
+        newdivid = document.getElementById('ltisec_divchgprivkey_'+hostid);
+        radioname = form.elements['ltisec_changeprivkey_'+hostid];
+        if (radioname) {
+            if (radioname.length > 0) {
+                var setvis;
+                for (var i=0; i<radioname.length; i++) {
+                    if (radioname[i].checked == true) {
+                        if (radioname[i].value == 1) {
+                            newdivid.style.display = 'inline-block';
+                            currdivid.style.display = 'none';
+                            setvis = 1;
+                        }
+                        break;
+                    }
+                }
+                if (!setvis) {
+                    newdivid.style.display = 'none';
+                    currdivid.style.display = 'inline-block';
+                }
+            }
+        }
+    }
+}
+
+// ]]>
+</script>
+
+ENDSCRIPT
+}
+
 sub autoupdate_javascript {
     return <<"ENDSCRIPT";
 <script type="text/javascript">
@@ -5048,6 +5232,146 @@ sub ltitools_names {
     return %lt;
 }
 
+sub print_lti {
+    my ($position,$dom,$settings,$rowtotal) = @_;
+    my $itemcount = 1;
+    my ($datatable,$css_class);
+    my (%rules,%encrypt,%privkeys,%linkprot);
+    if (ref($settings) eq 'HASH') {
+        if ($position eq 'top') {
+            if (exists($settings->{'encrypt'})) {
+                if (ref($settings->{'encrypt'}) eq 'HASH') {
+                    foreach my $key (keys(%{$settings->{'encrypt'}})) {
+                        $encrypt{'ltisec_'.$key.'linkprot'} = $settings->{'encrypt'}{$key};
+                    }
+                }
+            }
+            if (exists($settings->{'private'})) {
+                if (ref($settings->{'private'}) eq 'HASH') {
+                    if (ref($settings->{'private'}) eq 'HASH') {
+                        if (ref($settings->{'private'}{'keys'}) eq 'ARRAY') {
+                            map { $privkeys{$_} = 1; } (@{$settings->{'private'}{'keys'}});
+                        }
+                    }
+                }
+            }
+        } elsif ($position eq 'middle') {
+            if (exists($settings->{'rules'})) {
+                if (ref($settings->{'rules'}) eq 'HASH') {
+                    %rules = %{$settings->{'rules'}};
+                }
+            }
+        } elsif ($position eq 'bottom') {
+            if (exists($settings->{'linkprot'})) {
+                if (ref($settings->{'linkprot'}) eq 'HASH') {
+                    %linkprot = %{$settings->{'linkprot'}};
+                    if ($linkprot{'lock'}) {
+                        delete($linkprot{'lock'});
+                    }
+                }
+            }
+        }
+    }
+    if ($position eq 'top') {
+        my @ids=&Apache::lonnet::current_machine_ids();
+        my %servers = &Apache::lonnet::get_servers($dom,'library');
+        my $primary = &Apache::lonnet::domain($dom,'primary');
+        my ($extra,$numshown);
+        foreach my $hostid (sort(keys(%servers))) {
+            my ($showextra,$divsty,$switch);
+            if ($hostid eq $primary) {
+                if ($encrypt{'ltisec_domlinkprot'}) {
+                    $showextra = 1;
+                }
+            }
+            if ($encrypt{'ltisec_crslinkprot'}) {
+                $showextra = 1;
+            }
+            unless (grep(/^\Q$hostid\E$/,@ids)) {
+                $switch = 1;
+            }
+            if ($showextra) {
+                $numshown ++;
+                $divsty = 'display:inline-block';
+            } else {
+                $divsty = 'display:none';
+            }
+            $extra .= '<fieldset id="ltisec_info_'.$hostid.'" style="'.$divsty.'">'.
+                      '<legend>'.$hostid.'</legend>';
+            if ($switch) {
+                my $switchserver = '<a href="/adm/switchserver?otherserver='.$hostid.'&amp;role='.
+                                   &HTML::Entities::encode($env{'request.role'},'\'<>"&').
+                                   '&amp;destinationurl=/adm/domainprefs">'.&mt('Switch Server').'</a>';
+                if (exists($privkeys{$hostid})) {
+                    $extra .= '<div id="ltisec_divcurrprivkey_'.$hostid.'" style="display:inline-block" />'.
+                              '<span class="LC_nobreak">'.
+                              &mt('Encryption Key').': ['.&mt('not shown').'] '.('&nbsp;'x2).'</span></div>'.
+                              '<span class="LC_nobreak">'.&mt('Change?').
+                              '<label><input type="radio" value="0" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" checked="checked" />'.&mt('No').'</label>'.
+                              ('&nbsp;'x2).
+                              '<label><input type="radio" value="1" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" />'.&mt('Yes').
+                              '</label>&nbsp;&nbsp;</span><div id="ltisec_divchgprivkey_'.$hostid.'" style="display:none" />'.
+                              '<span class="LC_nobreak"> - '.&mt('submit from server ([_1]): [_2].',$hostid,$switchserver).
+                              '</span></div>';
+                } else {
+                    $extra .= '<span class="LC_nobreak">'.
+                              &mt('Key required').' - '.&mt('submit from server ([_1]): [_2].',$hostid,$switchserver).
+                              '</span>'."\n";
+                }
+            } elsif (exists($privkeys{$hostid})) {
+                $extra .= '<div id="ltisec_divcurrprivkey_'.$hostid.'" style="display:inline-block" /><span class="LC_nobreak">'.
+                          &mt('Encryption Key').': ['.&mt('not shown').'] '.('&nbsp;'x2).'</span></div>'.
+                          '<span class="LC_nobreak">'.&mt('Change?').
+                          '<label><input type="radio" value="0" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" checked="checked" />'.&mt('No').'</label>'.
+                          ('&nbsp;'x2).
+                          '<label><input type="radio" value="1" name="ltisec_changeprivkey_'.$hostid.'" onclick="javascript:togglePrivKey(this.form,'."'$hostid'".');" />'.&mt('Yes').
+                          '</label>&nbsp;&nbsp;</span><div id="ltisec_divchgprivkey_'.$hostid.'" style="display:none" />'.
+                          '<span class="LC_nobreak">'.&mt('New Key').':'.
+                          '<input type="password" size="20" name="ltisec_privkey_'.$hostid.'" value="" autocomplete="off" />'.
+                          '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.ltisec_privkey_'.$hostid.'.type='."'text'".' } else { this.form.ltisec_privkey_'.$hostid.'.type='."'password'".' }" />'.&mt('Visible input').'</label>'.
+                          '</span></div>';
+            } else {
+                $extra .= '<span class="LC_nobreak">'.&mt('Encryption Key').':'.
+                          '<input type="password" size="20" name="ltisec_privkey_'.$hostid.'" value="" autocomplete="off" />'.
+                          '<label><input type="checkbox" name="visible" onclick="if (this.checked) { this.form.ltisec_privkey_'.$hostid.'.type='."'text'".' } else { this.form.ltisec_privkey_'.$hostid.'.type='."'password'".' }" />'.&mt('Visible input').'</label>';
+            }
+            $extra .= '</fieldset>';
+        }
+        my %choices = &Apache::lonlocal::texthash (
+                                                      ltisec_crslinkprot => 'Encrypt stored link protection secrets defined in courses',
+                                                      ltisec_domlinkprot => 'Encrypt stored link protection secrets defined in domain',
+                                                  );
+        my @toggles = qw(ltisec_crslinkprot ltisec_domlinkprot);
+        my %defaultchecked = (
+                               'ltisec_crslinkprot' => 'off',
+                               'ltisec_domlinkprot' => 'off',
+                             );
+        my ($onclick,$itemcount);
+        $onclick = 'javascript:toggleLTIEncKey(this.form);';
+        ($datatable,$itemcount) = &radiobutton_prefs(\%encrypt,\@toggles,\%defaultchecked,
+                                                     \%choices,$itemcount,$onclick,'','left','no');
+
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        my $noprivkeysty = 'display:inline-block';
+        if ($numshown) {
+            $noprivkeysty = 'display:none';
+        }
+        $datatable .= '<tr '.$css_class.'><td><span class="LC_nobreak">'.&mt('Encryption Key(s)').'</td>'.
+                      '<td><div id="ltisec_noprivkey" style="'.$noprivkeysty.'" >'.
+                      '<span class="LC_nobreak">'.&mt('Not in use').'</span></div>'.
+                      $extra.
+                      '</td></tr>';
+        $itemcount ++;
+        $$rowtotal += $itemcount;
+    } elsif ($position eq 'middle') {
+        $datatable = &password_rules('secrets',\$itemcount,\%rules);
+        $$rowtotal += $itemcount;
+    } elsif ($position eq 'bottom') {
+         $datatable .= &Apache::courseprefs::print_linkprotection($dom,'',$settings,$rowtotal,'','','domain');
+    }
+    return $datatable;
+}
+
 sub print_coursedefaults {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my ($css_class,$datatable,%checkedon,%checkedoff,%defaultchecked,@toggles);
@@ -5063,6 +5387,7 @@ sub print_coursedefaults {
         postsubmit           => 'Disable submit button/keypress following student submission',
         canclone             => "People who may clone a course (besides course's owner and coordinators)",
         mysqltables          => 'Lifetime (s) of "Temporary" MySQL tables (student performance data) on homeserver',
+        ltiauth              => 'Student username in LTI launch of deep-linked URL can be accepted without re-authentication',
     );
     my %staticdefaults = (
                            anonsurvey_threshold => 10,
@@ -5184,8 +5509,12 @@ sub print_coursedefaults {
         my ($currdefresponder,%defcredits,%curruploadquota,%deftimeout,%currmysql);
         my $currusecredits = 0;
         my $postsubmitclient = 1;
+        my $ltiauth = 0;
         my @types = ('official','unofficial','community','textbook');
         if (ref($settings) eq 'HASH') {
+            if ($settings->{'ltiauth'}) {
+                $ltiauth = 1;
+            }
             $currdefresponder = $settings->{'anonsurvey_threshold'};
             if (ref($settings->{'uploadquota'}) eq 'HASH') {
                 foreach my $type (keys(%{$settings->{'uploadquota'}})) {
@@ -5331,7 +5660,16 @@ sub print_coursedefaults {
         }
         $datatable .= '</tr></table></td></tr>'."\n";
         $itemcount ++;
-
+        %defaultchecked = ('ltiauth' => 'off');
+        @toggles = ('ltiauth');
+        $current = {
+                       'ltiauth' => $ltiauth,
+                   };
+        ($table,$itemcount) =
+            &radiobutton_prefs($current,\@toggles,\%defaultchecked,
+                               \%choices,$itemcount,undef,undef,'left');
+        $datatable .= $table;
+        $itemcount ++;
     }
     $$rowtotal += $itemcount;
     return $datatable;
@@ -5847,84 +6185,7 @@ sub print_passwords {
             $itemcount ++;
         }
     } elsif ($position eq 'lower') {
-        my ($min,$max,%chars,$numsaved);
-        $min = $Apache::lonnet::passwdmin;
-        if (ref($settings) eq 'HASH') {
-            if ($settings->{min}) {
-                $min = $settings->{min};
-            }
-            if ($settings->{max}) {
-                $max = $settings->{max};
-            }
-            if (ref($settings->{chars}) eq 'ARRAY') {
-                map { $chars{$_} = 1; } (@{$settings->{chars}});
-            }
-            if ($settings->{numsaved}) {
-                $numsaved = $settings->{numsaved};
-            }
-        }
-        my %rulenames = &Apache::lonlocal::texthash(
-                                                     uc => 'At least one upper case letter',
-                                                     lc => 'At least one lower case letter',
-                                                     num => 'At least one number',
-                                                     spec => 'At least one non-alphanumeric',
-                                                   );
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_min" value="'.$min.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
-                      '</span></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_max" value="'.$max.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
-                      '</span></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'chars'}.'<br />'.
-                      '<span class="LC_nobreak LC_fontsize_small">'.&mt('(Leave unchecked if not required)').
-                      '</span></td>';
-        my $numinrow = 2;
-        my @possrules = ('uc','lc','num','spec');
-        $datatable .= '<td class="LC_left_item"><table>';
-        for (my $i=0; $i<@possrules; $i++) {
-            my ($rem,$checked);
-            if ($chars{$possrules[$i]}) {
-                $checked = ' checked="checked"';
-            }
-            $rem = $i%($numinrow);
-            if ($rem == 0) {
-                if ($i > 0) {
-                    $datatable .= '</tr>';
-                }
-                $datatable .= '<tr>';
-            }
-            $datatable .= '<td><span class="LC_nobreak"><label>'.
-                          '<input type="checkbox" name="passwords_chars" value="'.$possrules[$i].'"'.$checked.' />'.
-                          $rulenames{$possrules[$i]}.'</label></span></td>';
-        }
-        my $rem = @possrules%($numinrow);
-        my $colsleft = $numinrow - $rem;
-        if ($colsleft > 1 ) {
-            $datatable .= '<td colspan="'.$colsleft.'" class="LC_left_item">'.
-                          '&nbsp;</td>';
-        } elsif ($colsleft == 1) {
-            $datatable .= '<td class="LC_left_item">&nbsp;</td>';
-        }
-        $datatable .='</table></td></tr>';
-        $itemcount ++;
-        $css_class = $itemcount%2?' class="LC_odd_row"':'';
-        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
-                      '<td class="LC_left_item"><span class="LC_nobreak">'.
-                      '<input type="text" name="passwords_numsaved" value="'.$numsaved.'" size="3" '.
-                      'onblur="javascript:warnIntPass(this);" />'.
-                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
-                      '</span></td></tr>';
+        $datatable .= &password_rules('passwords',\$itemcount,$settings);
     } else {
         my ($othertitle,$usertypes,$types) = &Apache::loncommon::sorted_inst_types($dom);
         my %ownerchg = (
@@ -5984,6 +6245,117 @@ sub print_passwords {
     return $datatable;
 }
 
+sub password_rules {
+    my ($prefix,$itemcountref,$settings) = @_;
+    my ($min,$max,%chars,$numsaved,$numinrow);
+    my %titles;
+    if ($prefix eq 'passwords') {
+        %titles = &Apache::lonlocal::texthash (
+            min            => 'Minimum password length',
+            max            => 'Maximum password length',
+            chars          => 'Required characters',
+        );
+    } elsif ($prefix eq 'secrets') {
+        %titles = &Apache::lonlocal::texthash (
+            min            => 'Minimum secret length',
+            max            => 'Maximum secret length',
+            chars          => 'Required characters',
+        );
+    }
+    $min = $Apache::lonnet::passwdmin;
+    my $datatable;
+    my $itemcount;
+    if (ref($itemcountref)) {
+        $itemcount = $$itemcountref;
+    }
+    if (ref($settings) eq 'HASH') {
+        if ($settings->{min}) {
+            $min = $settings->{min};
+        }
+        if ($settings->{max}) {
+            $max = $settings->{max};
+        }
+        if (ref($settings->{chars}) eq 'ARRAY') {
+            map { $chars{$_} = 1; } (@{$settings->{chars}});
+        }
+        if ($prefix eq 'passwords') {
+            if ($settings->{numsaved}) {
+                $numsaved = $settings->{numsaved};
+            }
+        }
+    }
+    my %rulenames = &Apache::lonlocal::texthash(
+                                                 uc => 'At least one upper case letter',
+                                                 lc => 'At least one lower case letter',
+                                                 num => 'At least one number',
+                                                 spec => 'At least one non-alphanumeric',
+                                               );
+    my $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'min'}.'</td>'.
+                  '<td class="LC_left_item"><span class="LC_nobreak">'.
+                  '<input type="text" name="'.$prefix.'_min" value="'.$min.'" size="3" '.
+                  'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                  '<span class="LC_fontsize_small"> '.&mt('(Enter an integer: 7 or larger)').'</span>'.
+                  '</span></td></tr>';
+    $itemcount ++;
+    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'max'}.'</td>'.
+                  '<td class="LC_left_item"><span class="LC_nobreak">'.
+                  '<input type="text" name="'.$prefix.'_max" value="'.$max.'" size="3" '.
+                  'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                  '<span class="LC_fontsize_small"> '.&mt('(Leave blank for no maximum)').'</span>'.
+                  '</span></td></tr>';
+    $itemcount ++;
+    $css_class = $itemcount%2?' class="LC_odd_row"':'';
+    $datatable .= '<tr'.$css_class.'><td>'.$titles{'chars'}.'<br />'.
+                  '<span class="LC_nobreak LC_fontsize_small">'.&mt('(Leave unchecked if not required)').
+                  '</span></td>';
+    my $numinrow = 2;
+    my @possrules = ('uc','lc','num','spec');
+    $datatable .= '<td class="LC_left_item"><table>';
+    for (my $i=0; $i<@possrules; $i++) {
+        my ($rem,$checked);
+        if ($chars{$possrules[$i]}) {
+            $checked = ' checked="checked"';
+        }
+        $rem = $i%($numinrow);
+        if ($rem == 0) {
+            if ($i > 0) {
+                $datatable .= '</tr>';
+            }
+            $datatable .= '<tr>';
+        }
+        $datatable .= '<td><span class="LC_nobreak"><label>'.
+                      '<input type="checkbox" name="'.$prefix.'_chars" value="'.$possrules[$i].'"'.$checked.' />'.
+                      $rulenames{$possrules[$i]}.'</label></span></td>';
+    }
+    my $rem = @possrules%($numinrow);
+    my $colsleft = $numinrow - $rem;
+    if ($colsleft > 1 ) {
+        $datatable .= '<td colspan="'.$colsleft.'" class="LC_left_item">'.
+                      '&nbsp;</td>';
+    } elsif ($colsleft == 1) {
+        $datatable .= '<td class="LC_left_item">&nbsp;</td>';
+    }
+    $datatable .='</table></td></tr>';
+    $itemcount ++;
+    if ($prefix eq 'passwords') {
+        $titles{'numsaved'} = &mt('Number of previous passwords to save and disallow reuse');
+        $css_class = $itemcount%2?' class="LC_odd_row"':'';
+        $datatable .= '<tr'.$css_class.'><td>'.$titles{'numsaved'}.'</td>'.
+                      '<td class="LC_left_item"><span class="LC_nobreak">'.
+                      '<input type="text" name="'.$prefix.'_numsaved" value="'.$numsaved.'" size="3" '.
+                      'onblur="javascript:warnInt'.$prefix.'(this);" />'.
+                      '<span class="LC_fontsize_small"> '.&mt('(Leave blank to not save previous passwords)').'</span>'.
+                      '</span></td></tr>';
+        $itemcount ++;
+    }
+    if (ref($itemcountref)) {
+        $$itemcountref += $itemcount;
+    }
+    return $datatable;
+}
+
 sub print_wafproxy {
     my ($position,$dom,$settings,$rowtotal) = @_;
     my $css_class;
@@ -7957,7 +8329,7 @@ sub user_formats_row {
                    'username' => 'new usernames',
                    'id'       => 'IDs',
                );
-    unless ($type eq 'email') {
+    unless (($type eq 'email') || ($type eq 'unamemap')) {
         my $css_class = $rowcount%2?' class="LC_odd_row"':'';
         $output = '<tr '.$css_class.'>'.
                   '<td><span class="LC_nobreak">'.
@@ -8012,9 +8384,9 @@ sub user_formats_row {
     } elsif ($colsleft == 1) {
         $output .= '<td class="LC_left_item">&nbsp;</td>';
     }
-    $output .= '</tr></table>';
-    unless ($type eq 'email') {
-        $output .= '</td></tr>';
+    $output .= '</tr>';
+    unless (($type eq 'email') || ($type eq 'unamemap')) {
+        $output .= '</table></td></tr>';
     }
     return $output;
 }
@@ -8155,7 +8527,7 @@ sub print_defaults {
             $datatable .= '</td></tr>';
             $rownum ++;
         }
-    } else {
+    } elsif ($position eq 'middle') {
         my %defaults;
         if (ref($settings) eq 'HASH') {
             if ((ref($settings->{'inststatusorder'}) eq 'ARRAY') && (ref($settings->{'inststatustypes'}) eq 'HASH')) {
@@ -8205,6 +8577,22 @@ sub print_defaults {
                 $rownum ++;
             }
         }
+    } else {
+        my ($unamemaprules,$ruleorder) =
+            &Apache::lonnet::inst_userrules($dom,'unamemap');
+        $css_class = $rownum%2?' class="LC_odd_row"':'';
+        if ((ref($unamemaprules) eq 'HASH') && (ref($ruleorder) eq 'ARRAY')) {
+            my $numinrow = 2;
+            $datatable .= '<tr'.$css_class.'><td>'.&mt('Available conversions').'</td><td><table>'.
+                          &user_formats_row('unamemap',$settings,$unamemaprules,
+                                            $ruleorder,$numinrow).
+                          '</table></td></tr>';
+        }
+        if ($datatable eq '') {
+            $datatable .= '<tr'.$css_class.'><td colspan="2">'.
+                          &mt('No rules set for domain in customized localenroll.pm').
+                          '</td></tr>';
+        }
     }
     $$rowtotal += $rownum;
     return $datatable;
@@ -8973,17 +9361,26 @@ ENDSCRIPT
 }
 
 sub passwords_javascript {
-    my %intalert = &Apache::lonlocal::texthash (
-        authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
-        authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
-        passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
-        passmax => 'Warning: maximum password length must be a positive integer (or blank).',
-        passexp => 'Warning: days before password expiration must be a positive integer (or blank).',
-        passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
-    );
+    my ($prefix) = @_;
+    my %intalert;
+    if ($prefix eq 'passwords') {
+        %intalert = &Apache::lonlocal::texthash (
+            authcheck => 'Warning: disallowing login for an authenticated user if the stored cost is less than the default will require a password reset by/for the user.',
+            authcost => 'Warning: bcrypt encryption cost for internal authentication must be an integer.',
+            passmin => 'Warning: minimum password length must be a positive integer greater than 6.',
+            passmax => 'Warning: maximum password length must be a positive integer (or blank).',
+            passnum => 'Warning: number of previous passwords to save must be a positive integer (or blank).',
+        );
+    } elsif ($prefix eq 'secrets') {
+        %intalert = &Apache::lonlocal::texthash (
+            passmin => 'Warning: minimum secret length must be a positive integer greater than 6.',
+            passmax => 'Warning: maximum secret length must be a positive integer (or blank).',
+        );
+    }
     &js_escape(\%intalert);
     my $defmin = $Apache::lonnet::passwdmin;
-    my $intauthjs = <<"ENDSCRIPT";
+    my $intauthjs;
+    if ($prefix eq 'passwords') { $intauthjs = <<"ENDSCRIPT";
 
 function warnIntAuth(field) {
     if (field.name == 'intauth_check') {
@@ -9003,11 +9400,17 @@ function warnIntAuth(field) {
     return;
 }
 
-function warnIntPass(field) {
+ENDSCRIPT
+
+     }
+
+     $intauthjs .= <<"ENDSCRIPT";
+
+function warnInt$prefix(field) {
     field.value.replace(/^\s+/,'');
     field.value.replace(/\s+\$/,'');
     var regexdigit=/^\\d+\$/;
-    if (field.name == 'passwords_min') {
+    if (field.name == '${prefix}_min') {
         if (field.value == '') {
             alert('$intalert{passmin}');
             field.value = '$defmin';
@@ -9027,29 +9430,15 @@ function warnIntPass(field) {
             field.value = '';
         }
         if (field.value != '') {
-            if (field.name == 'passwords_expire') {
-                var regexpposnum=/^\\d+(|\\.\\d*)\$/;
-                if (!regexpposnum.test(field.value)) {
-                    alert('$intalert{passexp}');
-                    field.value = '';
+            if (!regexdigit.test(field.value)) {
+                if (field.name == '${prefix}_max') {
+                    alert('$intalert{passmax}');
                 } else {
-                    var expval = parseFloat(field.value);
-                    if (expval == 0) {
-                        alert('$intalert{passexp}');
-                        field.value = '';
+                    if (field.name == '${prefix}_numsaved') {
+                        alert('$intalert{passnum}');
                     }
                 }
-            } else {
-                if (!regexdigit.test(field.value)) {
-                    if (field.name == 'passwords_max') {
-                        alert('$intalert{passmax}');
-                    } else {
-                        if (field.name == 'passwords_numsaved') {
-                            alert('$intalert{passnum}');
-                        }
-                    }
-                    field.value = '';
-                }
+                field.value = '';
             }
         }
     }
@@ -9628,7 +10017,7 @@ sub modify_login {
     my ($r,$dom,$confname,$lastactref,%domconfig) = @_;
     my ($resulttext,$errors,$colchgtext,%changes,%colchanges,%newfile,%newurl,
         %curr_loginvia,%loginhash,@currlangs,@newlangs,$addedfile,%title,@offon,
-        %currsaml,%saml,%samltext,%samlimg,%samlalt,%samlurl,%samltitle,%samlnotsso);
+        %currsaml,%saml,%samltext,%samlimg,%samlalt,%samlurl,%samltitle,%samlwindow,%samlnotsso);
     %title = ( coursecatalog => 'Display course catalog',
                adminmail => 'Display administrator E-mail address',
                helpdesk  => 'Display "Contact Helpdesk" link',
@@ -9652,6 +10041,7 @@ sub modify_login {
                     $samlalt{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'alt'};
                     $samlimg{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'img'};
                     $samltitle{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'title'};
+                    $samlwindow{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'window'};
                     $samlnotsso{$lonhost} = $domconfig{login}{'saml'}{$lonhost}{'notsso'};
                 }
             }
@@ -9909,10 +10299,13 @@ sub modify_login {
             if ($env{'form.saml_img_'.$lonhost.'.filename'}) {
                 push(@newsamlimgs,$lonhost);
             }
-            foreach my $item ('text','alt','url','title','notsso') {
+            foreach my $item ('text','alt','url','title','window','notsso') {
                 $env{'form.saml_'.$item.'_'.$lonhost} =~ s/^\s+|\s+$//g;
             }
             if ($saml{$lonhost}) {
+                if ($env{'form.saml_window_'.$lonhost} ne '1') {
+                    $env{'form.saml_window_'.$lonhost} = '';
+                }
                 if (grep(/^\Q$lonhost\E$/,@delsamlimg)) {
 #FIXME Need to obsolete published image
                     delete($currsaml{$lonhost}{'img'});
@@ -9930,13 +10323,16 @@ sub modify_login {
                 if ($env{'form.saml_title_'.$lonhost} ne $samltitle{$lonhost}) {
                     $changes{'saml'}{$lonhost} = 1;
                 }
+                if ($env{'form.saml_window_'.$lonhost} ne $samlwindow{$lonhost}) {
+                    $changes{'saml'}{$lonhost} = 1;
+                }
                 if ($env{'form.saml_notsso_'.$lonhost} ne $samlnotsso{$lonhost}) {
                     $changes{'saml'}{$lonhost} = 1;
                 }
             } else {
                 $changes{'saml'}{$lonhost} = 1;
             }
-            foreach my $item ('text','alt','url','title','notsso') {
+            foreach my $item ('text','alt','url','title','window','notsso') {
                 $currsaml{$lonhost}{$item} = $env{'form.saml_'.$item.'_'.$lonhost};
             }
         } else {
@@ -10137,19 +10533,22 @@ sub modify_login {
                                        alt    => 'Alt text for button image',
                                        url    => 'SSO URL',
                                        title  => 'Tooltip for SSO link',
+                                       window => 'Pop-up window if iframe',
                                        notsso => 'Text for non-SSO log-in',
                                     );
                         foreach my $lonhost (sort(keys(%{$changes{$item}}))) {
                             if (ref($currsaml{$lonhost}) eq 'HASH') {
                                 $resulttext .= '<li>'.&mt("$title{$item} in use for [_1]","<b>$lonhost</b>").
                                                '<ul>';
-                                foreach my $key ('text','img','alt','url','title','notsso') {
+                                foreach my $key ('text','img','alt','url','title','window','notsso') {
                                     if ($currsaml{$lonhost}{$key} eq '') {
                                         $resulttext .= '<li>'.&mt("$notlt{$key} not in use").'</li>';
                                     } else {
                                         my $value = "'$currsaml{$lonhost}{$key}'";
                                         if ($key eq 'img') {
                                             $value = '<img src="'.$currsaml{$lonhost}{$key}.'" />';
+                                        } elsif ($key eq 'window') {
+                                            $value = 'On';
                                         }
                                         $resulttext .= '<li>'.&mt("$notlt{$key} set to: [_1]",
                                                                   $value).'</li>';
@@ -12627,6 +13026,255 @@ sub get_ltitools_id {
     return ($id,$error);
 }
 
+sub modify_lti {
+    my ($r,$dom,$action,$lastactref,%domconfig) = @_;
+    my %domdefaults = &Apache::lonnet::get_domain_defaults($dom,1);
+    my (%encconfig,$errors,$resulttext);
+
+    my (%currltisec,%secchanges,%newltisec,%newltienc,%keyset,%newkeyset);
+    $newltisec{'private'}{'keys'} = [];
+    $newltisec{'encrypt'} = {};
+    $newltisec{'rules'} = {};
+    $newltisec{'linkprot'} = {};
+    if (ref($domconfig{'ltisec'}) eq 'HASH') {
+        %currltisec = %{$domconfig{'ltisec'}};
+        if (ref($currltisec{'linkprot'}) eq 'HASH') {
+            foreach my $id (keys(%{$currltisec{'linkprot'}})) {
+                unless ($id =~ /^\d+$/) {
+                    delete($currltisec{'linkprot'}{$id});
+                }
+            }
+        }
+        if (ref($currltisec{'private'}) eq 'HASH') {
+            if (ref($currltisec{'private'}{'keys'}) eq 'ARRAY') {
+                $newltisec{'private'}{'keys'} = $currltisec{'private'}{'keys'};
+                map { $keyset{$_} = 1; } @{$currltisec{'private'}{'keys'}};
+            }
+        }
+    }
+    foreach my $item ('crs','dom') {
+        my $formelement = 'form.ltisec_'.$item.'linkprot';
+        if ($env{$formelement}) {
+            $newltisec{'encrypt'}{$item} = 1;
+            if (ref($currltisec{'encrypt'}) eq 'HASH') {
+                unless ($currltisec{'encrypt'}{$item}) {
+                    $secchanges{'encrypt'} = 1;
+                }
+            } else {
+                $secchanges{'encrypt'} = 1;
+            }
+        } elsif (ref($currltisec{'encrypt'}) eq 'HASH') {
+            if ($currltisec{'encrypt'}{$item}) {
+                $secchanges{'encrypt'} = 1;
+            }
+        }
+    }
+    unless (exists($currltisec{'rules'})) {
+        $currltisec{'rules'} = {};
+    }
+    &password_rule_changes('secrets',$newltisec{'rules'},$currltisec{'rules'},\%secchanges);
+
+    my @ids=&Apache::lonnet::current_machine_ids();
+    my %servers = &Apache::lonnet::get_servers($dom,'library');
+
+    foreach my $hostid (keys(%servers)) {
+        if (($hostid ne '') && (grep(/^\Q$hostid\E$/,@ids))) {
+            my $newkey;
+            my $keyitem = 'form.ltisec_privkey_'.$hostid;
+            if (exists($env{$keyitem})) {
+                $env{$keyitem} =~ s/(`)/'/g;
+                if ($keyset{$hostid}) {
+                    if ($env{'form.ltisec_changeprivkey_'.$hostid}) {
+                        if ($env{$keyitem} ne '') {
+                            $secchanges{'private'} = 1;
+                            $newkeyset{$hostid} = $env{$keyitem};
+                        }
+                    }
+                } elsif ($env{$keyitem} ne '') {
+                    unless (grep(/^\Q$hostid\E$/,@{$newltisec{'private'}{'keys'}})) {
+                        push(@{$newltisec{'private'}{'keys'}},$hostid);
+                    }
+                    $secchanges{'private'} = 1;
+                    $newkeyset{$hostid} = $env{$keyitem};
+                }
+            }
+        }
+    }
+
+    my (%linkprotchg,$linkprotoutput,$is_home);
+    my $proterror = &Apache::courseprefs::process_linkprot($dom,'',$currltisec{'linkprot'},
+                                                           \%linkprotchg,'domain');
+    my $home = &Apache::lonnet::domain($dom,'primary');
+    unless (($home eq 'no_host') || ($home eq '')) {
+        my @ids=&Apache::lonnet::current_machine_ids();
+        foreach my $id (@ids) { if ($id eq $home) { $is_home=1; } }
+    }
+
+    if (keys(%linkprotchg)) {
+        $secchanges{'linkprot'} = 1;
+        my %oldlinkprot;
+        if (ref($currltisec{'linkprot'}) eq 'HASH') {
+            %oldlinkprot = %{$currltisec{'linkprot'}};
+        }
+        foreach my $id (keys(%linkprotchg)) {
+            if (ref($linkprotchg{$id}) eq 'HASH') {
+                foreach my $inner (keys(%{$linkprotchg{$id}})) {
+                    if (($inner eq 'secret') || ($inner eq 'key')) {
+                        if ($is_home) {
+                            $newltienc{$id}{$inner} = $linkprotchg{$id}{$inner};
+                        }
+                    }
+                }
+            } else {
+                $newltisec{'linkprot'}{$id} = $linkprotchg{$id};
+            }
+        }
+        $linkprotoutput = &Apache::courseprefs::store_linkprot($dom,'','domain',\%linkprotchg,\%oldlinkprot);
+        if (keys(%linkprotchg)) {
+            %{$newltisec{'linkprot'}} = %linkprotchg;
+        }
+    }
+    if (ref($currltisec{'linkprot'}) eq 'HASH') {
+        foreach my $id (%{$currltisec{'linkprot'}}) {
+            next if ($id !~ /^\d+$/);
+            unless (exists($linkprotchg{$id})) {
+                if (ref($currltisec{'linkprot'}{$id}) eq 'HASH') {
+                    foreach my $inner (keys(%{$currltisec{'linkprot'}{$id}})) {
+                        if (($inner eq 'secret') || ($inner eq 'key')) {
+                            if ($is_home) {
+                                $newltienc{$id}{$inner} = $currltisec{'linkprot'}{$id}{$inner};
+                            }
+                        } else {
+                            $newltisec{'linkprot'}{$id}{$inner} = $currltisec{'linkprot'}{$id}{$inner};
+                        }
+                    }
+                } else {
+                    $newltisec{'linkprot'}{$id} = $currltisec{'linkprot'}{$id};
+                }
+            }
+        }
+    }
+    if ($proterror) {
+        $errors .= '<li>'.$proterror.'</li>';
+    }
+
+    my ($putresult,%keystore);
+    if (keys(%secchanges)) {
+        my %ltienchash;
+        my %ltihash = (
+                          'ltisec' => { %newltisec }
+                      );
+        $putresult = &Apache::lonnet::put_dom('configuration',\%ltihash,$dom);
+        if ($putresult eq 'ok') {
+            if ($secchanges{'private'}) {
+                my $who = &escape($env{'user.name'}.':'.$env{'user.domain'});
+                foreach my $hostid (keys(%newkeyset)) {
+                    my $storehash = {
+                                       key => $newkeyset{$hostid},
+                                       who => $env{'user.name'}.':'.$env{'user.domain'},
+                                    };
+                    $keystore{$hostid} = &Apache::lonnet::store_dom($storehash,'lti','private',
+                                                                    $dom,$hostid);
+                }
+            }
+            if (ref($lastactref) eq 'HASH') {
+                if (($secchanges{'encrypt'}) || ($secchanges{'private'})) {
+                    $lastactref->{'domdefaults'} = 1;
+                }
+            }
+            if (($secchanges{'linkprot'}) && ($is_home)) {
+                my %ltienchash = (
+                                     'linkprot' =>  { %newltienc }
+                                 );
+                &Apache::lonnet::put_dom('encconfig',\%ltienchash,$dom,undef,1);
+            }
+        }
+    } else {
+        return &mt('No changes made.');
+    }
+    if ($putresult eq 'ok') {
+        $resulttext = &mt('Changes made:').'<ul>';
+        foreach my $item (keys(%secchanges)) {
+            if ($item eq 'encrypt') {
+                my %encrypted = (
+                          crs  => {
+                                    on => &mt('Encryption of stored link protection secrets defined in courses enabled'),
+                                    off => &mt('Encryption of stored link protection secrets defined in courses disabled'),
+                                  },
+                          dom => {
+                                   on => &mt('Encryption of stored link protection secrets defined in domain enabled'),
+                                   off => &mt('Encryption of stored link protection secrets defined in domain disabled'),
+                                 },
+                );
+                foreach my $type ('crs','dom') {
+                    my $shown = $encrypted{$type}{'off'};
+                    if (ref($newltisec{$item}) eq 'HASH') {
+                        if ($newltisec{$item}{$type}) {
+                            $shown = $encrypted{$type}{'on'};
+                        }
+                    }
+                    $resulttext .= '<li>'.$shown.'</li>';
+                }
+            } elsif ($item eq 'rules') {
+                my %titles = &Apache::lonlocal::texthash(
+                                  min   => 'Minimum password length',
+                                  max   => 'Maximum password length',
+                                  chars => 'Required characters',
+                );
+                foreach my $rule ('min','max') {
+                    if ($newltisec{rules}{$rule} eq '') {
+                        if ($rule eq 'min') {
+                            $resulttext .= '<li>'.&mt('[_1] not set.',$titles{$rule});
+                                           ' '.&mt('Default of [_1] will be used',
+                                                       $Apache::lonnet::passwdmin).'</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('[_1] set to none',$titles{$rule}).'</li>';
+                        }
+                    } else {
+                        $resulttext .= '<li>'.&mt('[_1] set to [_2]',$titles{$rule},$newltisec{rules}{$rule}).'</li>';
+                    }
+                }
+                if (ref($newltisec{'rules'}{'chars'}) eq 'ARRAY') {
+                    if (@{$newltisec{'rules'}{'chars'}} > 0) {
+                        my %rulenames = &Apache::lonlocal::texthash(
+                                            uc => 'At least one upper case letter',
+                                            lc => 'At least one lower case letter',
+                                            num => 'At least one number',
+                                            spec => 'At least one non-alphanumeric',
+                                            );
+                        my $needed = '<ul><li>'.
+                                     join('</li><li>',map {$rulenames{$_} } @{$newltisec{'rules'}{'chars'}}).
+                                     '</li></ul>';
+                        $resulttext .= '<li>'.&mt('[_1] set to: [_2]',$titles{'chars'},$needed).'</li>';
+                    } else {
+                        $resulttext .= '<li>'.&mt('[_1] set to none',$titles{'chars'}).'</li>';
+                    }
+                } else {
+                    $resulttext .= '<li>'.&mt('[_1] set to none',$titles{'chars'}).'</li>';
+                }
+            } elsif ($item eq 'private') {
+                if (keys(%newkeyset)) {
+                    foreach my $hostid (sort(keys(%newkeyset))) {
+                        if ($keystore{$hostid} eq 'ok') {
+                            $resulttext .= '<li>'.&mt('Encryption key for storage of shared secrets saved for [_1]',$hostid).'</li>';
+                        }
+                    }
+                }
+            } elsif ($item eq 'linkprot') {
+                $resulttext .= $linkprotoutput;
+            }
+        }
+        $resulttext .= '</ul>';
+    } else {
+        $errors .= '<li><span class="LC_error">'.&mt('Failed to save changes').'</span></li>';
+    }
+    if ($errors) {
+        $resulttext .= &mt('The following errors occurred: ').'<ul>'.
+                       $errors.'</ul>';
+    }
+    return $resulttext;
+}
+
 sub modify_autoenroll {
     my ($dom,$lastactref,%domconfig) = @_;
     my ($resulttext,%changes);
@@ -14075,56 +14723,7 @@ sub modify_passwords {
             $updatedefaults = 1;
         }
     }
-    foreach my $rule ('min','max','numsaved') {
-        $env{'form.passwords_'.$rule} =~ s/^\s+|\s+$//g;
-        my $ruleok;
-        if ($rule eq 'min') {
-            if ($env{'form.passwords_'.$rule} =~ /^\d+$/) {
-                if ($env{'form.passwords_'.$rule} >= $Apache::lonnet::passwdmin) {
-                    $ruleok = 1;
-                }
-            }
-        } elsif (($env{'form.passwords_'.$rule} =~ /^\d+$/) &&
-                 ($env{'form.passwords_'.$rule} ne '0')) {
-            $ruleok = 1;
-        }
-        if ($ruleok) {
-            $newvalues{$rule} = $env{'form.passwords_'.$rule};
-            if (exists($current{$rule})) {
-                if ($newvalues{$rule} ne $current{$rule}) {
-                    $changes{'rules'} = 1;
-                }
-            } elsif ($rule eq 'min') {
-                if ($staticdefaults{$rule} ne $newvalues{$rule}) {
-                    $changes{'rules'} = 1;
-                }
-            } else {
-                $changes{'rules'} = 1;
-            }
-        } elsif (exists($current{$rule})) {
-            $changes{'rules'} = 1;
-        }
-    }
-    my @posschars = &Apache::loncommon::get_env_multiple('form.passwords_chars');
-    my @chars;
-    foreach my $item (sort(@posschars)) {
-        if ($item =~ /^(uc|lc|num|spec)$/) {
-            push(@chars,$item);
-        }
-    }
-    $newvalues{'chars'} = \@chars;
-    unless ($changes{'rules'}) {
-        if (ref($current{'chars'}) eq 'ARRAY') {
-            my @diffs = &Apache::loncommon::compare_arrays($current{'chars'},\@chars);
-            if (@diffs > 0) {
-                $changes{'rules'} = 1;
-            }
-        } else {
-            if (@chars > 0) {
-                $changes{'rules'} = 1;
-            }
-        }
-    }
+    &password_rule_changes('passwords',\%newvalues,\%current,\%changes);
     my %crsownerchg = (
                         by => [],
                         for => [],
@@ -14384,6 +14983,71 @@ sub modify_passwords {
     return $resulttext;
 }
 
+sub password_rule_changes {
+    my ($prefix,$newvalues,$current,$changes) = @_;
+    return unless ((ref($newvalues) eq 'HASH') &&
+                   (ref($current) eq 'HASH') &&
+                   (ref($changes) eq 'HASH'));
+    my (@rules,%staticdefaults);
+    if ($prefix eq 'passwords') {
+        @rules = ('min','max','numsaved');
+    } elsif ($prefix eq 'secrets') {
+        @rules = ('min','max');
+    }
+    $staticdefaults{'min'} = $Apache::lonnet::passwdmin;
+    foreach my $rule (@rules) {
+        $env{'form.'.$prefix.'_'.$rule} =~ s/^\s+|\s+$//g;
+        my $ruleok;
+        if ($rule eq 'min') {
+            if ($env{'form.'.$prefix.'_'.$rule} =~ /^\d+$/) {
+                if ($env{'form.'.$prefix.'_'.$rule} >= $staticdefaults{$rule}) {
+                    $ruleok = 1;
+                }
+            }
+        } elsif (($env{'form.'.$prefix.'_'.$rule} =~ /^\d+$/) &&
+                 ($env{'form.'.$prefix.'_'.$rule} ne '0')) {
+            $ruleok = 1;
+        }
+        if ($ruleok) {
+            $newvalues->{$rule} = $env{'form.'.$prefix.'_'.$rule};
+            if (exists($current->{$rule})) {
+                if ($newvalues->{$rule} ne $current->{$rule}) {
+                    $changes->{'rules'} = 1;
+                }
+            } elsif ($rule eq 'min') {
+                if ($staticdefaults{$rule} ne $newvalues->{$rule}) {
+                    $changes->{'rules'} = 1;
+                }
+            } else {
+                $changes->{'rules'} = 1;
+            }
+        } elsif (exists($current->{$rule})) {
+            $changes->{'rules'} = 1;
+        }
+    }
+    my @posschars = &Apache::loncommon::get_env_multiple('form.'.$prefix.'_chars');
+    my @chars;
+    foreach my $item (sort(@posschars)) {
+        if ($item =~ /^(uc|lc|num|spec)$/) {
+            push(@chars,$item);
+        }
+    }
+    $newvalues->{'chars'} = \@chars;
+    unless ($changes->{'rules'}) {
+        if (ref($current->{'chars'}) eq 'ARRAY') {
+            my @diffs = &Apache::loncommon::compare_arrays($current->{'chars'},\@chars);
+            if (@diffs > 0) {
+                $changes->{'rules'} = 1;
+            }
+        } else {
+            if (@chars > 0) {
+                $changes->{'rules'} = 1;
+            }
+        }
+    }
+    return;
+}
+
 sub modify_usercreation {
     my ($dom,%domconfig) = @_;
     my ($resulttext,%curr_usercreation,%changes,%authallowed,%cancreate,%save_usercreate);
@@ -15722,6 +16386,41 @@ sub modify_defaults {
             $newvalues{$item} = $staticdefaults{$item};
         }
     }
+    my ($unamemaprules,$ruleorder);
+    my @possunamemaprules = &Apache::loncommon::get_env_multiple('form.unamemap_rule');
+    if (@possunamemaprules) {
+        ($unamemaprules,$ruleorder) =
+            &Apache::lonnet::inst_userrules($dom,'unamemap');
+        if ((ref($unamemaprules) eq 'HASH') && (ref($ruleorder) eq 'ARRAY')) {
+            if (@{$ruleorder} > 0) {
+                my %possrules;
+                map { $possrules{$_} = 1; } @possunamemaprules;
+                foreach my $rule (@{$ruleorder}) {
+                    if ($possrules{$rule}) {
+                        push(@{$newvalues{'unamemap_rule'}},$rule);
+                    }
+                }
+            }
+        }
+    }
+    if (ref($domdefaults{'unamemap_rule'}) eq 'ARRAY') {
+        if (ref($newvalues{'unamemap_rule'}) eq 'ARRAY') {
+            my @rulediffs = &Apache::loncommon::compare_arrays($domdefaults{'unamemap_rule'},
+                                                               $newvalues{'unamemap_rule'});
+            if (@rulediffs) {
+                $changes{'unamemap_rule'} = 1;
+                $domdefaults{'unamemap_rule'} = $newvalues{'unamemap_rule'};
+            }
+        } elsif (@{$domdefaults{'unamemap_rule'}} > 0) {
+            $changes{'unamemap_rule'} = 1;
+            delete($domdefaults{'unamemap_rule'});
+        }
+    } elsif (ref($newvalues{'unamemap_rule'}) eq 'ARRAY') {
+        if (@{$newvalues{'unamemap_rule'}} > 0) {
+            $changes{'unamemap_rule'} = 1;
+            $domdefaults{'unamemap_rule'} = $newvalues{'unamemap_rule'};
+        }
+    }
     my %defaults_hash = (
                          defaults => \%newvalues,
                         );
@@ -15838,6 +16537,26 @@ sub modify_defaults {
                             $resulttext .= '<li>'.&mt('Institutional user status types deleted').'</li>';
                         }
                     }
+                } elsif ($item eq 'unamemap_rule') {
+                    if (ref($newvalues{'unamemap_rule'}) eq 'ARRAY') {
+                        my @rulenames;
+                        if (ref($unamemaprules) eq 'HASH') {
+                            foreach my $rule (@{$newvalues{'unamemap_rule'}}) {
+                                if (ref($unamemaprules->{$rule}) eq 'HASH') {
+                                    push(@rulenames,$unamemaprules->{$rule}->{'name'});
+                                }
+                            }
+                        }
+                        if (@rulenames) {
+                            $resulttext .= '<li>'.&mt('Mapping for missing usernames includes: [_1]',
+                                                     '<ul><li>'.join('</li><li>',@rulenames).'</li></ul>').
+                                           '</li>';
+                        } else {
+                            $resulttext .= '<li>'.&mt('No mapping for missing usernames via standard log-in').'</li>'; 
+                        } 
+                    } else {
+                        $resulttext .= '<li>'.&mt('Mapping for missing usernames via standard log-in deleted').'</li>';
+                    }
                 } else {
                     my $value = $env{'form.'.$item};
                     if ($value eq '') {
@@ -16797,8 +17516,9 @@ sub modify_coursedefaults {
                            'uselcmath'       => 'on',
                            'usejsme'         => 'on',
                            'inline_chem'     => 'on',
+                           'ltiauth'         => 'off',
                          );
-    my @toggles = ('uselcmath','usejsme','inline_chem');
+    my @toggles = ('uselcmath','usejsme','inline_chem','ltiauth');
     my @numbers = ('anonsurvey_threshold','uploadquota_official','uploadquota_unofficial',
                    'uploadquota_community','uploadquota_textbook','mysqltables_official',
                    'mysqltables_unofficial','mysqltables_community','mysqltables_textbook');
@@ -17008,8 +17728,8 @@ sub modify_coursedefaults {
             if (($changes{'uploadquota'}) || ($changes{'postsubmit'}) ||
                 ($changes{'coursecredits'}) || ($changes{'uselcmath'}) || ($changes{'usejsme'}) ||
                 ($changes{'canclone'}) || ($changes{'mysqltables'}) || ($changes{'texengine'}) ||
-                ($changes{'inline_chem'})) {
-                foreach my $item ('uselcmath','usejsme','inline_chem','texengine') {
+                ($changes{'inline_chem'}) || ($changes{'ltiauth'})) {
+                foreach my $item ('uselcmath','usejsme','inline_chem','texengine','ltiauth') {
                     if ($changes{$item}) {
                         $domdefaults{$item}=$defaultshash{'coursedefaults'}{$item};
                     }
@@ -17174,6 +17894,12 @@ sub modify_coursedefaults {
                     } else {
                         $resulttext .= '<li>'.&mt('By default, only course owner and coordinators may clone a course.').'</li>';
                     }
+                } elsif ($item eq 'ltiauth') {
+                    if ($env{'form.'.$item} eq '1') {
+                        $resulttext .= '<li>'.&mt('LTI launch of deep-linked URL need not require re-authentication').'</li>';
+                    } else {
+                        $resulttext .= '<li>'.&mt('LTI launch of deep-linked URL will require re-authentication').'</li>';
+                    }
                 }
             }
             $resulttext .= '</ul>';